The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-112177: Red Hat: A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 87.3 HighN/AN/AOct 20, 2026
CVE-2026-111090: Stormshield Stormshield Network Security: A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and…7.8 HighN/AN/AOct 20, 2026
CVE-2024-2323: WSO2: The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history…4.8 MediumN/AN/AOct 20, 2026
CVE-2026-113407: YS-infoware BA-Workflow: BA-Workflow developed by YS-infoware has a SQL Injection vulnerability8.8 High8.7 HighN/AOct 20, 2026
CVE-2026-113406: YS-infoware BA-Workflow: BA-Workflow developed by YS-infoware has a SQL Injection vulnerability8.8 High8.7 HighN/AOct 20, 2026
CVE-2026-113405: YS-infoware BA-Workflow: BA-Workflow developed by YS-infoware has a SQL Injection vulnerability8.8 High8.7 HighN/AOct 20, 2026
CVE-2026-113404: Uniong WebITR: WebITR developed by Uniong has a Insecure Deserialization vulnerability8.8 High8.7 HighN/AOct 20, 2026
CVE-2026-113402: ArmorX Global Technology ArmorX Spam: ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-112148: LY Corporation LIFF SDK: A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting…N/A5.1 MediumN/AOct 20, 2026
CVE-2026-110725: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js3.7 LowN/AN/AOct 20, 2026
CVE-2026-110306: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js6.1 MediumN/AN/AOct 20, 2026
CVE-2026-110180: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js4.8 MediumN/AN/AOct 20, 2026
CVE-2026-110095: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js3.7 LowN/AN/AOct 20, 2026
CVE-2026-113403: ArmorX Global Technology ArmorX Spam: ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-93878: Divigear DiviGear Carousel: The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action…6.4 MediumN/AN/AOct 20, 2026
CVE-2026-97627: Atsumi Electric Co., Ltd.: Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd7.2 High8.6 HighN/AOct 20, 2026
CVE-2026-96903: Unknown Easy Property Listings: The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its…4.3 MediumN/AN/AOct 20, 2026
CVE-2026-96902: Unknown Easy Property Listings: The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public…5.3 MediumN/AN/AOct 20, 2026
CVE-2026-93300: EventOn EventON - Subscriber: The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all…7.5 HighN/AN/AOct 20, 2026
CVE-2026-100737: Atsumi Electric Co., Ltd.: Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd4.9 Medium6.9 MediumN/AOct 20, 2026
CVE-2026-113386: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection7.1 HighN/AN/AOct 20, 2026
CVE-2026-113380: Signal RingRTC: In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the…N/A9.3 CriticalN/AOct 20, 2026
CVE-2026-109831: GNU Project UnRTF: UnRTF by GNU Project is vulnerable to out-of-bounds write5.4 Medium5.1 MediumN/AOct 20, 2026
CVE-2026-86467: Apache Software Foundation Apache Airflow Amazon provider: Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the…N/AN/AN/AOct 20, 2026
CVE-2026-12489: Zyxel EX3501-T0 firmware: An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through…6.5 MediumN/AN/AOct 20, 2026
276-300 of 407346
‹›